Re: Photoscore

[David Wright]

On Tue 29 Nov 2016 at 09:37:21 (+0100), David Kastrup wrote:
> David Wright <address@hidden> writes:
> 
> > On Mon 28 Nov 2016 at 21:26:17 (+0000), Karlin High wrote:
> >> On 11/28/2016 2:12 PM, David Wright wrote:
> >> > So it should be worth booting from a live linux CD to mount the
> >> > partitions to check their contents, and to reinstall Grub
> >> > (or whatever you use to boot) into the MBR.
> >> 
> >> The thing to do IMMEDIATELY is make a "drive image backup."
> >
> > That would certainly be the action to take if the drive was giving
> > disk errors.
> 
> It's also the action to take if you are dealing with damage to the data
> structures.

That doesn't necessarily buy you any advantage in the case you
outlined. There are risks in making bit for bit copies of a drive.
For starters, you're _writing_ to a device, whereas attempting to
mount the partitions readonly involves _no_ writing to any device.

Only on the 18th, I read a post where a user was trying to make an
image of a drive, and was relying on the order they plugged in the
two drives to get the kernel to assign the "correct" /dev/sdX values
to the two drives so that they could then follow some remotely
posted instructions for making the copy. Talk about tail wagging dog!

> > I don't know anything about these particular tools. I would use a tool
> > like GNU ddrescue works its way from good part of the disk to bad
> > parts, so maximising the amount of data recovered. It keeps a log file
> > of its actions so that the process can be interrupted. After all,
> > recovering a large, badly damaged disk can take a very long time.
> 
> We are not talking about hardware damage in this case.

Yes, that's why my next two sentences were "However, there's no
evidence that disk errors have been or will be a problem. This is just
a case of overwriting." The paragraph you _have_ quoted was in
response to the choice of Karlin High's tools, not to the specifics of
your problem.

> > Some or all of these actions can avoid the need to purchase another
> > drive of at least the same size, whose cost can be considerable, and,
> > after downloading a live CD onto a USB stick, could potentially set a
> > data owner's mind at rest after only a few minutes.
> 
> My father is living away several hours and is not technically savvy.
> The system boots into some sort of maintenance mode, so making a disk
> image via dd via phone instructions is going to be reasonably easy.  He
> can then send the image over by matter mail.

The one thing I _wouldn't_ want to do is boot the system at all using
the drive under consideration. If you've lost control of your MBR,
then all bets are off as to which OS is going to boot and in what
circumstances. You risk yet more damage to the system.

If you maintain that the _only_ sensible course of action is: "The
thing to do IMMEDIATELY is make a "drive image backup" (which is what
this post appears to be supporting), then you have got to boot from a
different drive or a device like a CD or stick in order to make an
unadulterated copy. "Some sort of maintenance mode" doesn't cut it.
(And I don't even know whether you mean a linux or a windows mode.)

> > Of course, if you've got the cash, you can just hand the disk or
> > entire system to a data recovery agency that you trust, who will have
> > professionals to do the job. But many of us do not live in that world.
> 
> A few lucky ones have capable children though.

Cheers,
David.